[codex] Add OTA candidate cache

[n30nex]

Summary

• add a verified OTA candidate cache behind the existing manifest contract
• add ota fetch, ota stage <path>, ota clear, and expanded ota status serial diagnostics
• stream T-Deck HTTP/HTTPS firmware downloads to a bounded temp file, then verify exact size and SHA-256 before promotion
• preserve an existing verified candidate if a new stage/download/promotion fails
• document that this is a pre-install cache only; inactive-slot writes, boot selection, rollback UX, and update UI remain follow-up work

Validation

• git diff --check
• git diff --cached --check
• python -m py_compile scripts\\fetch_tdeck_artifact.py scripts\\release_evidence.py scripts\\tdeck_smoke.py
• pio run -e native
• .pio\\build\\native\\program.exe --selftest
• .pio\\build\\native\\program.exe --simtest
• pio run -e tdeck
• fixed the first CI failure where Linux exposed overlapping snprintf use in the wrong-size OTA candidate error path; reran native selftest/simtest and T-Deck build after the fix
• GitHub Actions Firmware CI run 27874332021 passed for head 7113e726468a6f1a2a49e441ce7247f316ac5082

Artifact

• fetched exact standard artifact: tdeck-firmware-7113e726468a6f1a2a49e441ce7247f316ac5082
• artifact run: 27874332021
• output: .pio\\ci-artifacts\\tdeck-ota-candidate-cache
• manifest: budget_status=pass, firmware_bytes=1717376, static_ram_bytes=231152, firmware_slot_pct=32.76

Hardware

• COM8 enumerated as USB Serial Device (COM8), VID/PID 303A:1001, status OK
• flashed the exact Actions artifact to COM8 with direct no-stub esptool; ESP32-S3 rev v0.2, MAC cc:8d:a2:0d:14:28, bootloader/partitions/boot_app0/firmware hashes verified
• first post-flash attach reached lz> and passed id, then timed out on sys; no-reflash retry was used
• retry command: python scripts\\tdeck_smoke.py --port COM8 --skip-upload --open-timeout 60 --boot-timeout 90 --timeout 90 --no-expect --commands id sys net rf stats wifi "ota status" "ota test" "ota boot-test" "ota fetch" "companion test"
• retry result: smoke PASS
• observed identity: !a20d1428 "limitlessdeck" (LIMI)
• observed system: battery 100% at 4.64V USB, RAM 43/150KB
• observed RF: Meshtastic on, MeshCore off, RF diagnostics responsive
• OTA diagnostics: ota status -> no cached manifest and no candidate; ota test -> PASS; ota boot-test -> PASS; ota fetch -> [err] no cached manifest and no candidate
• companion test: PASS (fw=2.7.15.567b8ea, min_app=30200)

Notes

• This PR intentionally does not call ESP-IDF OTA write or boot-partition APIs yet.
• The candidate cache is the safe prerequisite for the next Phase 10 slice: installing the verified candidate into the inactive OTA slot.